REMARKS 

Claims 1-13 are pending in the application. Reconsideration is requested in view 
of the above amendments and the following remarks. 

The Examiner has considered the Applicants arguments, but has deemed them 
moot in view of new rejections presented by the Examiner. 

Claims 1-13 stand rejected as being provisionally rejected on the ground of 
nonstatutory obviousness-type double patenting in view of: 

claims 4-17 of copending application no. 09/800,328; 

claims 1-36 of copending application no. 10/655,387; and 

claims 1-12 of copending application no. 09/838,979. 

Reconsideration of the rejection is respectfully requested in view of the above 
amendments and the remarks presented herein. In the event the Examiner maintains this 
rejection, Applicant acknowledges that it may be overcome by submitting a terminal 
disclaimer. 

Claims 1-13 stand rejected under 35 U.S.C. 103(a) as being unpatentable over US 
Patent 5,070,528 ("Hawe") in view of US Patent 6,393,568 ("Ranger 1 '). This rejection is 
respectfully but strenuously traversed and reconsideration and a withdrawal of the 
rejection is hereby respectfully requested. 

The Applicant's invention is not disclosed or suggested by the Hawe reference 
alone or even when combined with Ranger as the Examiner proposes. Accordingly, 
Applicant's present invention should be patentable. The Examiner contends that Hawe 
discloses an apparatus and method for intercepting and processing code on a 
communications channel, specifically asserting that the protocol is parsed by means of a 
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protocol parser and then transferred to be decrypted (by means of a decryption 
component) (citing col. 10, lines 38-44 and col. 10, line 63 - col. 11, line 1). The 
Examiner interprets Hawe to read that the code is intercepted by the protocol parsing 
means as it is transmitted through the communication channel, contending that this is so 
because Hawe appears to disclose a step of identifying the protocol (by means of a 
protocol scanner) used to generate the packets to determine which type of encryption is 
needed (citing col. lines 38-44). 

The Examiner admits that Hawe is deficient of a disclosure of a proscribed code 
scanner that scans the decrypted code, and seeks to fill this deficiency with the additional 
Ranger reference. The Examiner contends that Ranger, at col. 6, lines 32-43, teaches 
indicating the presence of the proscribed code if the indicator is positive. The Examiner 
contends that it would have been obvious to apply decryption prior to scanning for 
viruses, since Ranger appears to the Examiner to discuss a need for detecting viruses in 
communications received in encrypted form such that it would provide virus protection in 
real time for a communication system (citing col. 1, lines 58-64) and that virus programs 
are not able to decrypt encrypted information (citing col. 1, lines 21-23). The Examiner 
therefore concludes that one looking at Hawe would see Ranger as beneficial as a means 
of scanning encrypted files by decrypting the files prior to scanning for viruses to provide 
real-time content inspection for viruses. 

The references cited by the Examiner do not teach, suggest or disclose the 
Applicant's invention. Applicant has amended claim 1 to more particularly articulate the 
invention by reciting that said scanner reintroduces to the communication channel all, 
some or none of the intercepted code . Applicant's present method and apparatus claims 
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intercepting and processing code on a communications channel. Applicant's method and 
apparatus are thus operating at the streams level. Referring to the Applicant's 
specification, at par [0022]: 

The preferred embodiments process code. The preferred embodiments process, 
that is, intercept, examine, and/or control any or all code streams transferred 
through any number of connections in a computer or network. Intercepting, 
examining and/or controlling code includes but is not limited to monitoring, 
blocking, logging, quarantining, discarding or transferring code. 

In other words, streaming data, or the sequence of digitally encoded coherent signals, is 

what Applicant's invention relates to. Hawe relates to files or packets, and appears to be 

operating at a different level than the Applicant's invention. 

Furthermore, Applicant's invention is further distinguishable over Hawe. Hawe 

discloses appending a cryptographic preamble to the beginning of an information packet 

and using a cryptographic processor to determine the need for cryptographic processing 

based on the preamble previously appended, and stripping the preamble before 

transmission onto the network. Applicant's invention provides a protocol parser which 

intercepts code traveling on a communications channel and transmits the code for review 

by a code scanner, whereupon the code (some, none or all) is reintroduced to the 

communications channel. Hawe fails to disclose a protocol parser which may be placed 

so as to intercept code passing through a particular communications channel and 

communicate code to a protocol scanner. Hawe discloses providing a receive data path 

which includes a DES (data encryption standard). If the Examiner considers that Haws 

discloses a protocol parser, and deems that structure to be the Hawe receive control state 

machine (24) (see col. 9, lines 65-66), then this cannot be Applicant's invention. Hawe 

fails to disclose a protocol parser, but merely uses language indicating that "parsing of an 
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incoming packet" is being accomplished. Applicant discloses and claims a protocol 
parser, and in addition thereto, claims a protocol scanner. Hawe appears to disclose 
parsing or analyzing an incoming data packet. Again, Hawe is not operating at the 
streams level, as is Applicant's claimed invention. 

Applicant's invention is still not disclosed even upon making the combination 
proposed by the Examiner. Hawe discusses that the function of the receive control state 
machine (24) is to parse or analyze each incoming data packet received from the media 
access control (MAC). 

Hawe, contrary to the Applicant* present invention, prepends code in order for the 
Hawe method to be carried out. This is further illustrated in that Hawe, in each of its 
claims, defines as its invention, this prepending (though Hawe refers to it as appending to 
the front a code sequence). Applicant's invention provides scanning of a stream of 
communication, and not files, and not using appended/prepended content. Hawe not only 
fails to disclose or suggest the Applicant's claimed invention, but rather, Hawe relates to 
and teaches something else. Hawe does not appear to function, nor does it provide any 
suggestion of how to function, as the Applicant's claimed method and apparatus do. 

It would be inconsistent to apply the teachings of Ranger, since the Examiner 
relies on Ranger for a disclosure of a content inspection mechanism which the Examiner 
considers to be a proscribed code scanner. According to Hawe, there is parsing an LLC 
(logical link control) header, and when the cryptographic processor does not recognize a 
SNAP/SAP packet, then a decision is made not to decrypt (block 42) and the packet is 
passed on to the RMC interface without further cryptographic processing. (See col. 1 1, 
lines 32-39.) Therefore, it is contrary to the teachings of Hawe to decrypt packets in the 
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manner which the Examiner maintains that Ranger suggests. One of ordinary skill in the 
art would not have looked to Ranger's teaching as being combinable with Hawe. 



CONCLUSION 

Applicant's invention is not taught, suggested or disclosed by the cited references 
relied on by the Examiner. Accordingly, Applicant's presently claimed invention should 
be patentable. 

If necessary, an appropriate extension of time to respond is respectfully requested. 

The Commissioner is authorized to charge any additional fees which may be 

required to Patent Office Deposit Account No. 05-0208. 

Respectfully submitted, 
JOHN F. A. EARLEY III 
FRANK J. BONINI, JR. 
CHARLES L. RIDDLE 

HARDING, EARLEY, FOLLMER & FRAILEY 
Attorneys for Applicant 
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